On March 9, 2016, employees of Mossack Fonseca, a Panamanian law firm that for decades had kept the financial secrets of global celebrities, oligarchs and criminals, made a stomach-churning discovery. Someone had copied huge amounts of data from its computers.
Emails, contracts, banking statements – 11.5 million documents of the firm’s most sensitive client records, a staggering 2.6 terabytes of data – had been taken.
Suddenly, the day-to-day business of setting up shell companies in tax havens was no longer the priority. Instead, newly obtained Mossack Fonseca documents show, employees began working furiously on a new mission: find out who its clients were.
As a key player in the world of offshore finance, Mossack Fonseca had for years flouted rules requiring lawyers and other offshore specialists to identify and verify their clients, requirements designed to prevent aiding criminal activity.
Over the next weeks and months, newly leaked documents show, Mossack Fonseca employees frantically emailed bankers, accountants and lawyers –the professionals who had hired the firm to set up shell companies for clients who wanted to remain anonymous – in an attempt to close the gaps in its recordkeeping. Those intermediaries responded with panic and fury.
“THE CLIENT DISAPPEARED! I CAN NOT FIND HIM ANYMORE!!!!!!!,” Nicole Didi, a Swiss wealth management adviser, wrote in March 2017. She was an intermediary for 80 companies set up by Mossack Fonseca.
“This has been ridiculous,” wrote Eliezer Panell, a Florida lawyer who grew exasperated at Mossack Fonseca’s multiple requests – sometimes only one day apart – that he obtain and share documents from two offshore company owners to prove their identity.
“WE CAN’T GO BACK a day after asking for papers to ask for something else,” he wrote. “WE LOOK LIKE F--KING AMATEURS. A Mickey Mouse operation.”
The new documents reveal that Mossack Fonseca couldn’t identify tens of thousands of owners of companies it had registered in opaque, low-tax jurisdictions. Two months after the firm became aware of the records breach, it still couldn’t identify owners of more than 70 percent of 28,500 active companies in the British Virgin Islands, the firm’s busiest offshore hub, and 75 percent of 10,500 active shell companies in Panama, the records show.
That represented a significant risk. Failure to comply with know-your-client rules, which have grown ever stricter as governments have stepped up efforts to combat terrorism funding and money laundering, could expose Mossack Fonseca to lawsuits and even criminal investigations – and force the firm to shutter the shell companies, throwing its own and clients’ businesses into chaos.
“It shouldn’t be acceptable that a firm like this doesn’t know the owner of one shell company, let alone thousands of them,” said Jack Blum, a U.S. attorney who specializes in tax fraud and money laundering.
This account of Mossack Fonseca’s final months is the result of a second major leak from the firm. The first leak led to the Panama Papers investigation and the firm’s undoing.
In April 2016 the International Consortium of Investigative Journalists and more than 100 media partners published hundreds of stories based on the leak of millions of internal documents that exposed the firm’s inner workings from the late 1970s to 2015.
The Panama Papers investigation convulsed the worlds of politics, finance and law. The roster of publicity-shy parties who used Mossack Fonseca’s services included members of Vladimir Putin’s inner circle, the then-prime minister of Iceland, and a company suspected of holding proceeds from a famous 1983 London gold heist.
Iceland’s prime minister, Sigmundur David Gunnlaugsson, resigned after the investigation revealed a stake in an offshore company that he and his wife used secretly to hold nearly $4 million in bonds in Icelandic banks, even as his government was negotiating with the banks’ creditors.
Pakistanis protested in the streets when it was revealed that children of then-prime minister Nawaz Sharif had set up shell companies to help discreetly hold multi-million dollar London real estate. Sharif resigned in July 2017 after Pakistan’s supreme court disqualified him from office.
By the end of 2016, governments and companies in 79 countries had opened 150 inquiries, audits or investigations into the law firm, its intermediaries or clients.
The new leak offers a view inside Mossack Fonseca and the circle of professionals it did business with in the weeks before the Panama Papers investigation broke and afterward, as the firm scrambled to identify clients and clients began to drift away. The documents date from early 2016 through the end of 2017, a few months before the firm collapsed.
As with the Panama Papers, the information was obtained by the newspaper Süddeutsche Zeitung. The records were shared with ICIJ and its media partners.
Decades of secrecy and then a breach
Mossack Fonseca, founded in 1986, developed a niche helping the rich conceal their wealth offshore, for reasons both legal and illicit. Based in Panama City, the firm eventually had operations in more than 30 countries, working closely with global banks including HSBC, UBS and Credit Suisse and law firms in the Netherlands, Mexico, the United States and Switzerland.
Mossack Fonseca rarely communicated directly with the ultimate beneficiaries of its work. It corresponded instead with the intermediaries that stood between the firm and the wealthy individuals seeking to shield luxury homes, yachts and jets, bank accounts and valuable art collections. Some beneficiaries of Mossack Fonseca’s discreet services used shell companies to bribe government officials and hide away mountains of cash.
The arrangement allowed Mossack Fonseca to operate largely in obscurity for decades.
But with the discovery of the computer breach in March 2016, the firm shifted fully into crisis mode.
The day after the breach was confirmed, Mossack Fonseca’s lawyer asked Panama’s attorney general to launch a criminal investigation and “urgently interrogate” journalists from France, Denmark, Australia, the United States and Germany who were in Panama filming documentaries for what would become the Panama Papers investigation. The lawyer demanded, unsuccessfully, that the journalists reveal how they obtained documents from Mossack Fonseca.
Many emails to Mossack Fonseca after the April 3 publication of the Panama Papers investigation echoed one sent by Charles Hotton, managing director of a Jersey subsidiary of the Bank of Singapore, which helps the wealthy protect their assets.
“URGENT…what documents/BO info was taken from files and when,” Hotton wrote, referring to the so-called “beneficial owners” of offshore companies, whose names are often concealed.
Sometimes, high-profile clients themselves rushed forward to prove to Mossack Fonseca they were the true owners of shell companies, worried that the firm would drop them otherwise and leave them in legal limbo.
Aides of Ukraine’s president Petro Poroshenko sent the embattled law firm an electricity bill to prove his identity after anti-money laundering authorities in the British Virgin Islands demanded ownership confirmation of Poroshenko’s offshore company.
The correspondence includes 17 emails with representatives of Hollywood star Jackie Chan, a Mossack Fonseca client who provided his scanned passport and an American Express statement in an attempt to keep open offshore trading and film production companies and to help Mossack Fonseca avoid fines for incomplete paperwork. Mossack Fonseca also corresponded with lawyers who helped manage the Panama company of Argentinian soccer superstar Lionel Messi, who had recently been found guilty of tax fraud in Spain.
One of Switzerland’s highest-profile lawyers excoriated the firm on behalf of the family of Beny Steinmetz, a mining executive now under investigation in Israel for alleged bribery and corruption in Africa.
“The leaking of information of which Mossack Fonseca & Co was the guardian has caused damage to our clients, who were wrong to have trusted you and believed in your abilities and professional rigor,” wrote lawyer Marc Bonnant.
A spokeswoman for Steinmetz told ICIJ the bribery and corruption allegations are baseless.
ICIJ sought comment from intermediaries named in this story, but none responded.
Amid its campaign to identify its clients, Mossack Fonseca was trying to limit the fallout from the leak.
Mossack Fonseca told clients and intermediaries it had installed a firewall to rebuff computer attacks and that it had introduced a system to encrypt emails and documents about the most sensitive part of the offshore industry – who owns what.
The firm hired media relations consultants to “give our version of the events.” It pointed clients to an opinion piece by Daniel Mitchell, co-founder of the libertarian Center for Freedom and Prosperity, in Caribbean News Now. Mitchell proactively wrote that “firms like Mossack Fonseca are merely just the latest stand-ins and proxies for a much wider campaign being waged by left-wing governments and their various allies and interest groups.”
Mitchell told ICIJ that a Mossack Fonseca employee contacted him after the leak but that he was “already on top of the issue.”
“The protection and security of information is our most important priority,” Mossack Fonseca told clients in a May 2016 announcement after the Panama Papers publication. “We once again apologize for the difficult situation that has been created by this unlawful breach.”
Clients weren’t much reassured by the firm’s attempts at damage control, records show.
One Swiss intermediary was totally fed up. “By a lot of messages, you, MOSSACK, are trying to convince we clients that you are taking control of this unbelievable situation,” Félix Chille wrote.
The message concluded: “This email will, probably, be intercepted like 11,600,000 other documents. I don't care.”
In the weeks and months after the story broke, governments opened investigations into companies set up by some of Mossack Fonseca’s busiest office locations, including Panama, the British Virgin Islands, Samoa, the Seychelles and Anguilla.
In April 2016, the Seychelles Financial Services Authority asked the firm to reveal who owned some of the 5,379 active companies it had incorporated in the island archipelago.
An audit by the Seychelles’ financial crime agency months later concluded that Mossack Fonseca’s office had violated six anti-money-laundering laws and regulations, according to the new files.
“Overall, the examiners found significant deficiencies in Mossack Fonseca Seychelles’ operations,” wrote Phillip Moustache, director of the country’s Financial Intelligence Unit, in a letter to the firm.
The firm’s clients were also being investigated. Authorities in India, Spain, Sweden and Argentina demanded information from Mossack Fonseca about taxpayers who owned offshore companies through the firm, the newly leaked records show. Local police searched Mossack Fonseca’s British Virgin Islands office for records as part of a British bribery probe involving Nigerian oil mogul Kolawole Aluko.
Two months after publication of the Panama Papers investigation, British authorities forced Mossack Fonseca to hand over documents on a shell company managed by a subsidiary of Eurasian Natural Resources Corporation (ENRC), then a publicly-traded mining and energy company. ENRC was already being investigated for alleged bribery in Kazakhstan and Africa.
The ENRC shell company, Cofiparinter Ltd., was being investigated by the U.K’s Serious Fraud Office for corruption, bribery and money laundering and other alleged offenses, according to a copy of the search warrant. The investigation into the company has not previously been reported.
In response to questions about the British investigation, a spokesperson for ENRC said it'd "be inappropriate to comment on any ongoing investigation."
British authorities declined to comment on what prompted the Cofiparinter investigation or to say if it is ongoing.
Curiously missing from the documents, though, are any inquiries from the United States, and no significant investigations in that country have come to light.
“Eventually wither away”
At first, Mossack Fonseca tried to encourage its clients to remain loyal, despite the raging legal and public relations storm.
The firm slashed fees and offered some clients the option to change their shell company’s name so that business operations could discretely continue.
Mossack Fonseca changed its own business name, too. In Samoa, it became Central Corporate Services Ltd. In Panama, Mossack Fonseca transferred clients to Orbis Legal Services, which hired some Mossack Fonseca employees to maintain the “same level of service.”
Other clients simply moved their business to other offshore service providers in havens such as Guernsey in the Channel Islands, the British Virgin Islands and Cyprus. Clients started reporting that banks were refusing to accept or process any payments to Mossack Fonseca.
“YOUR COMPANY IS NOT RELIABLE AND CREDIBLE----------BYE BYE,” wrote Luxembourg-based intermediary Jeffrey Davies.
In May 2016, the firm announced to clients that it was shutting down its office in the Isle of Man, the British Crown dependency in the Irish Sea. Closures in Jersey and Hong Kong soon followed.
Later that year, Fonseca and Mossack announced that they would retire from the firm they had founded. A skeletal Mossack Fonseca would remain open to fulfill existing obligations but would “eventually wither away,” an email to clients said.
In February 2017, Panama’s attorney general, Kenia Porcell, alleged that Mossack Fonseca companies had been used to make and receive bribes across Latin America in connection with the Lava Jato or “car wash” scandal. The ongoing probe centers on allegations that dozens of politicians and executives at Brazil’s state-run oil company, Petrobras, received billions of dollars in bribes from contractors who were awarded generous contracts.
Attorney General Porcell called Mossack Fonseca “a criminal organization that is dedicated to hiding money assets from suspicious origins.” She ordered Mossack and Fonseca arrested on money laundering charges. The men, who denied wrongdoing, spent several months in jail.
“If this were Spain in the dark ages they would have us burning at the stake,” Mossack scrawled in a notebook from his jail cell.
Mossack and Fonseca were released on bail in April 2017. About a year later, their law firm closed for good.
In May 2018, Panama prosecutors charged 10 other Mossack Fonseca employees with money laundering in connection with Brazil’s Lava Jato scandal. Mossack remains under investigation by prosecutors in Cologne, Germany, as an accessory to tax evasion, according to a statement provided to Süddeutsche Zeitung.
According to Porcell, 71 people have been charged in Panama for alleged crimes because of the Panama Papers. She defended her two-year long probes.
"The complexity of these investigations is a consequence of the trans-national characteristics of the acts under investigation. Being investigated are the reception, deposit, negotiation, transfer or conversion of money, titles, stocks, real estate and other financial resources, with the object of hiding, covering up or disguising their illicit origin," said Porcell.
Mossack and Fonseca did not respond to specific questions from ICIJ or its partners. In June, the lawyers issued a press release that said the law firm, its employees and its founders were “never involved in unlawful acts.”
Their attorney, Guillermina McDonald, said of the pair, "They have their fight and as a lawyer I plan to demonstrate their innocence."
She also said they have no regrets.
"Never have I heard either of the two say they regret anything because they have not done anything for which to be regretful," McDonald said.
Will Fitzgibbon and Ben Hallman are reporters with the International Consortium of Investigative Journalists.